Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, mostramos como criar buckets de armazenamento isolados do Google Distributed Cloud (GDC).
Antes de começar
Um namespace de projeto gerencia recursos de bucket no servidor da API Management. Você
precisa ter um projeto para trabalhar com buckets e objetos.
Você também precisa ter as permissões de bucket adequadas para realizar a seguinte
operação. Consulte Conceder acesso ao bucket.
Diretrizes de nomenclatura de buckets de armazenamento
Os nomes de bucket precisam seguir estas convenções de nomenclatura:
Ser exclusivo no projeto. Um projeto adiciona um prefixo exclusivo ao nome do bucket, garantindo que não haja conflitos na organização. No caso improvável de um conflito entre um prefixo e um nome de bucket em várias organizações, a criação do bucket falha com um erro "nome do bucket em uso".
Não inclua informações de identificação pessoal (PII).
Estar em conformidade com o DNS.
Ter pelo menos 1 e no máximo 55 caracteres.
Comece com uma letra e use apenas letras, números e hifens.
Criar um bucket
Console
No menu de navegação, clique em Object Storage.
Clique em Criar bucket.
No fluxo de criação de bucket, atribua um nome exclusivo a todos os buckets do projeto.
Digite uma descrição.
Opcional: clique no botão toggle_off para definir uma política de retenção e insira o número de dias de sua preferência. Entre em contato com seu IO se precisar exceder os limites da política de retenção.
Clique em Criar. Uma mensagem de confirmação vai aparecer, e você vai voltar para a página Buckets.
Para verificar se você criou um bucket, atualize a página Buckets após alguns minutos e confira se o estado do bucket mudou de Not ready para Ready.
CLI
Para criar um bucket, aplique uma especificação ao namespace do projeto:
Somente a criptografia V2 é compatível com buckets de duas zonas, e todas as operações de criação, atualização ou exclusão de um recurso de bucket de duas zonas precisam ser realizadas no servidor de API global.
Verificar a criação do bucket e dos recursos relacionados
Depois que o bucket for criado, execute o comando a seguir para confirmar e verificar os detalhes dele:
kubectldescribebucketsBUCKET_NAME-nNAMESPACE_NAME
A seção Status tem dois campos importantes: Criptografia (para detalhes de criptografia) e Nome totalmente qualificado (que contém o FULLY_QUALIFIED_BUCKET_NAME).
Criptografia v1
As informações são sobre a AEADKey chamada obj-FULLY_QUALIFIED_BUCKET_NAME, que serve como referência à chave de criptografia usada para criptografar objetos armazenados no bucket. Veja um exemplo:
As informações se referem ao Secret chamado kek-ref-FULLY_QUALIFIED_BUCKET_NAME, que atua como uma referência para AEADKeys padrão ativas. As AEADKeys padrão ativas são selecionadas aleatoriamente para criptografar objetos enviados ao bucket quando uma AEADKey específica não é especificada.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines the process for creating air-gapped storage buckets within Google Distributed Cloud (GDC), which requires a project namespace for resource management and appropriate bucket permissions.\u003c/p\u003e\n"],["\u003cp\u003eBucket names must be unique within a project, DNS-compliant, between 1 and 55 characters, start with a letter, and use only letters, numbers, and hyphens, while refraining from containing personally identifiable information (PII).\u003c/p\u003e\n"],["\u003cp\u003eBuckets can be created through the console by navigating to Object Storage and filling out the creation flow or via the command line using a bucket specification in a YAML file.\u003c/p\u003e\n"],["\u003cp\u003eNewly created buckets are automatically encrypted, with \u003ccode\u003ev2\u003c/code\u003e being the default and strongly recommended for better encryption and security, unless \u003ccode\u003ev1\u003c/code\u003e is specifically designated for higher performance with many small objects.\u003c/p\u003e\n"],["\u003cp\u003eVerification of bucket creation and details, including encryption information and the fully qualified name, can be performed by using \u003ccode\u003ekubectl describe buckets\u003c/code\u003e and \u003ccode\u003ekubectl get aeadkeys\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create storage buckets for projects\n\nThis page shows you how to create Google Distributed Cloud (GDC) air-gapped storage buckets.\n\nBefore you begin\n----------------\n\nA project namespace manages bucket resources in the Management API server. You\nmust have a [project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/project-management) to work with buckets and objects.\n\nYou must also have the appropriate bucket permissions to perform the following\noperation. See [Grant bucket access](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/grant-obtain-storage-access#grant_bucket_access).\n\nStorage bucket naming guidelines\n--------------------------------\n\nBucket names must adhere to the following naming conventions:\n\n- Be unique within the project. A project appends a unique prefix to the bucket name, ensuring there aren't clashes within the organization. In the unlikely event of a prefix and bucket name clash across organizations, the bucket creation fails with a \"bucket name in use\" error.\n- Refrain from including any personally identifiable information (PII).\n- Be DNS-compliant.\n- Have at least 1 and no more than 55 characters.\n- Start with a letter and use only letters, numbers, and hyphens.\n\nCreate a bucket\n---------------\n\n**Note:** The bucket that is created will be automatically encrypted with either version `v1` or `v2`. `v2` will be the default if the `encryption-version` label is not specified since `v2` bucket is strongly recommended as it has better encryption and security. `v1` is only recommended if you need higher performance for many small objects. \n\n### Console\n\n1. In the navigation menu, click **Object Storage**.\n2. Click **Create Bucket**.\n3. In the bucket creation flow, assign a name unique across all buckets within the project.\n4. Enter a description.\n5. Optional: Click the toggle_off toggle to set a retention policy and enter your preferred number of days. Contact your IO if you need to exceed retention policy limits.\n6. Click **Create** . A success message appears and you are directed back to the **Buckets** page.\n\nTo verify that you have successfully created a new bucket, refresh the **Buckets** page after a few minutes and check that the bucket state updates from `Not ready` to `Ready`.\n\n### CLI\n\nTo create a bucket, apply a bucket specification to your project namespace: \n\n kubectl apply -f bucket.yaml\n\nThe following is an example of a bucket specification: \n\n apiVersion: object.gdc.goog/v1\n kind: Bucket\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eBUCKET_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n spec:\n description: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eDESCRIPTION\u003c/span\u003e\u003c/var\u003e\n storageClass: Standard\n bucketPolicy:\n lockingPolicy:\n defaultObjectRetentionDays: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eRETENTION_DAY_COUNT\u003c/span\u003e\u003c/var\u003e\n\nThe following is an example of a bucket specification with encryption version as `v1`: \n\n apiVersion: object.gdc.goog/v1\n kind: Bucket\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eBUCKET_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n labels:\n object.gdc.goog/encryption-version: v1\n spec:\n description: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eDESCRIPTION\u003c/span\u003e\u003c/var\u003e\n storageClass: Standard\n bucketPolicy:\n lockingPolicy:\n defaultObjectRetentionDays: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eRETENTION_DAY_COUNT\u003c/span\u003e\u003c/var\u003e\n\nFor more details, see the [Bucket API reference](../../apis/storage-krm-api.md).\n\nThe following is an example of a dual-zone bucket in org-admin global API: \n\n apiVersion: object.global.gdc.goog/v1\n kind: Bucket\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eBUCKET_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003ePROJECT_NAME\u003c/span\u003e\u003c/var\u003e\n spec:\n location: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eLOCATION_NAME\u003c/span\u003e\u003c/var\u003e\n description: Sample DZ Bucket\n storageClass: Standard\n\nNote that only V2 encryption is supported for dual-zone buckets and all operations for creating, updating, or deleting a dual-zone bucket resource must be performed against the global API server.\n\n### gdcloud\n\nTo create a bucket with gdcloud, follow [gdcloud storage buckets create](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-reference/gdcloud-storage-buckets-create).\n\nVerify bucket and related resource creation\n-------------------------------------------\n\nOnce the bucket is created, you can run the following command to confirm and check the details of the bucket: \n\n kubectl describe buckets \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e\n\nThe **Status** section has two important fields: **Encryption** (for encryption details) and **Fully Qualified Name** (which contains the \u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e). \n\n### Encryption v1\n\nThe information is about the AEADKey named as `obj-`\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e, which serves as a reference to the encryption key employed for encrypting objects stored within the bucket. Here is an example: \n\n Status:\n Encryption:\n Key Ref:\n Kind: AEADKey\n Name: obj-\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e\n Namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n Type: CMEK\n\n### Encryption v2\n\nThe information pertains to the Secret named as `kek-ref-`\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e, which acts as a reference for active default AEADKeys. Active default AEADKeys are randomly selected from to encrypt objects uploaded to the bucket when specific AEADKey is not specified.\n| **Note:** Inactive default AEADKeys are those that are no longer referenced in the Secret. See the Manage Encryption Resources section for more info.\n\nHere is an example: \n\n Status:\n Encryption:\n Key Ref:\n Kind: Secret\n Name: kek-ref-\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e\n Namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n Type: CMEK\n\nYou can also run the following command to verify needed AEADKeys are created: \n\n kubectl get aeadkeys -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e -l cmek.security.gdc.goog/resource-name=\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e"]]
